[IMGCAP(1)]
ATM manufacturers and organiza-tions concerned with ATM security are urging U.S. and European law-enforcement agencies to shut down a Web site that manufactures and sells card-skimming equipment.
Thieves use the devices to steal data off of magnetic stripes and then use the information to create counterfeit cards.
Industry representatives have spoken to the U.S. Secret Service, the International Criminal Police Organization (Interpol) and the European Law Enforcement Cooperation in Europe (Europol), but so far none has been able to close the Web site, which ATM Skimmers Ltd. operates.
Their inability to close the Web site demonstrates the difficulty in locating and shutting down such sites. Though selling card skimmers may not be illegal, ATM manufacturers, deployers and networks contend criminals use them for illegal purposes.
"Bad guys now can go online and order skimming devices," says Lachlan Gunn, coordinator and founder of European ATM Security Team Ltd., an organization concerned with ATM security that is based in Edinburgh, Scotland. "The fact that it is still up shows how difficult it is to first locate where the site is being hosted and then shut is down."
Mike Lee, CEO of the ATM Industry Association, whose members include the leading ATM manufacturers, echoes Gunn's sentiments about the Web-site operator. "It seems to be evading capture and shutdown," Lee says.
Neither Interpol nor Europol responded to ATM&Debit News requests for comment. The U.S. Secret Service told off-premise ATM manufacturer Triton Systems of Delaware Inc. that the agency would monitor the Web site, says Bob Douglas, Triton director of engineering. Triton is based in Long Beach, Miss.
ATM manufacturers and those concerned with ATM security have a reason to worry. Javelin Strategy & Research, which is based in Pleasanton, Calif., said last week that 45% of cardholders lose confidence in their financial institutions as the result of data breaches.
"Skimming weakens security at ATMs and consumer confidence in ATMs, which means the industry would sell fewer ATMs," Douglas of Triton says.
Thieves attach skimmers to an ATM card reader, capturing cardholder data. They also install hidden cameras near the machine to record the cardholders entering their PINs.
ATM Skimmers sells the complete package. "All of our skimmers come with a PIN pad and a mini wireless camera that is activated when the skimmer is in use," the firm's Web site says.
The company claims it stocks skimmers for ATMs manufactured by Diebold Inc., Tranax Technologies Inc., Nautilus Hyosung Inc., Wincor Nixdorf AG, Triton and NCR Corp. It also says it specializes in custom building "NCR exterior and drive-up ATM skimmers."
ATM Skimmers also displays on its Web site 10 photographs of ATM skimmers it sells, yet it claims it does not promote illegal activity. However, individuals who buy its skimmers must pay the company 10% of the money they derive from using them.
"How can we sell skimmers? Easy; we build them in Russia, where it is not a problem to have them but is a problem using them," ATM Skimmers says on its Web site.
ATM skimming is a growing problem. The European ATM Security Team, which represents ATM deployers and networks in 24 European countries, recently published the "European ATM Crime Report," which covers the first six months of 2008.
According to the report, during that period 4,609 incidents of card skimming were reported, which is an increase of 143% compared with the 2,275 reported incidents during the same six-month period in 2007.
Thieves stole $341.9 million from cardholders in the first half of 2008, an increase of 110% from $162.8 million for the same six months in 2007.
Thieves also have attacked ATMs based in the United States.
Last year, for example, FBI agents arrested three Ukrainian nationals who used counterfeit ATM cards to steal nearly $6 million from Citibank N.A., First Bank of St. Louis and Washington Mutual Inc. (ADN, 7/10/08).
ATM manufacturers are not waiting for law-enforcement agencies to take action against Web sites that sell ATM skimmers.
North Canton, Ohio-based Diebold received an award in June for its advanced skimming-detection device, which detects the presence of skimming devices. Diebold installs the device in all new Opteva machines, Charles Ducey Jr., Diebold senior vice of global development and services, said in a statement.
Other ATM manufacturers also have installed devices to prevent ATM skimming. Such countermeasures have caused skimming incidents across Europe to drop 17% between the second half of 2007 compared with the first half of 2008, but thieves are stealing more money, says the European ATM Security Team.
Brian J. Bailey, NCR vice president of financial industry marketing, said it may be time for the United States to consider adoption of EMV (Europay MasterCard Visa) chip card standards as an effective countermeasure to card skimming.
"In other markets, NCR has seen the effectiveness of technologies such as EMV-style chip cards," Bailey wrote in an e-mail message.
Jim Pettitt, Diebold director of ATM security strategy & planning, says it is harder for thieves steal data from cards that have microchips, and it is more difficult to reproduce the cards.
ATM manufacturers also are sharing technology with each other to prevent ATM skimming, Mark Smith, Triton senior value added reseller manager, tells ATM&Debit News. "We compete in other areas, but we are sharing information to stop skimming," he says. ATM
